A critical vulnerability in the PHP programming language, used by roughly 70 percent of websites, led governments and companies worldwide to take sites offline this week to apply emergency patches amid millions of exploit attempts.
A pair of critical vulnerabilities in PHP, dubbed PHP2Shell, allowed potential unauthenticated remote code execution and were patched on October 21, 2026, after existing for years in versions back to PHP 5.4.
The flaws, affecting the language that powers an estimated 70 percent of websites, prompted precautionary shutdowns of government and commercial sites in Europe, Japan, Canada, and elsewhere so operators could apply the fix before widespread exploitation.
Cloudflare reported millions of attempts to exploit the weakness within hours of disclosure, while national cybersecurity agencies including the UK's NCSC issued tens of thousands of alerts and confirmed no publicly verified successful compromises as of Friday.
The PHP Foundation released updates such as PHP 8.5.12, and organizations including the Wikimedia Foundation and various European government portals temporarily took systems offline, with most returning after patching.
Experts noted the incident highlighted the fragility of foundational internet software, with lingering risks for end-of-life or shared-hosting environments that update slowly.
People Sentiments Public Mood: Negative
- Cloudflare CEO Matthew Prince reported millions of exploit attempts
- PHP Foundation acknowledged structural challenges in response timing
- NCSC stated no confirmed successful hacks